CVE-2022-24692

Katalog CVE

CVSS 5.4 · Medium EPSS 0,67%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada dsknet. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. The new menu option within the general Parameters page is vulnerable to stored XSS. The attacker can create a menu option, make it visible to every application user, and conduct session hijacking, account takeover, or malicious code delivery, with the final goal of achieving client-side code execution.

Rincian

Terbit di NVD

18 Juli 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,67% peluang dieksploitasi; lebih tinggi dari 50,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/post-cyberlabs/CVE-Advisory/blob/main/CVE-2022-24688-92.pdf exploit · advisory pihak ketiga
• https://dsk.lu/fr/produits/temps-de-presence product